Google refused access

These come from Google, or from AdCopilot's own check of which accounts your workspace can reach. Asking again does not fix them by itself: something about access has to change first. A refused read changes nothing in your accounts.

USER_PERMISSION_DENIED

What you see. Your assistant gets Google's error:

Google Ads rejected the query: authorization_error USER_PERMISSION_DENIED: …

Google's message often goes on to say a manager's customer id must be set in a login-customer-id header. You don't need to do that (step 4). A full_audit can list every check as not evaluated with this error as the reason, and say "This audit could not be scored". On the dashboard's Tool calls page, a refused call shows the reason ToolError: ReadableGoogleAdsException USER_PERMISSION_DENIED.

Why it happens. Google says the Google login your call went out with cannot open that Google Ads account. Each person's calls go out with their own Google login, the one their own AdCopilot connection uses. The account list is the workspace's: an account anyone's login found can be switched on for everyone. AdCopilot sends a call only on an account your own login was found to reach; otherwise it refuses the call itself, before Google sees it (It is on, but your Google login cannot open it). So when Google refuses it, your login reached the account when AdCopilot last looked and has usually lost access to it in Google Ads since. get_org_context reads with your own login too. A teammate joining changes nothing by itself, and Refresh accounts or signing in again with the same login doesn't change it while that login has no access.

Fix.

1. Find the login your calls use: on Google products, the Google Ads card says "Google Ads connected through …" and names it.
2. Give that login access to the account, or connect the login that has it:
   • In Google Ads, someone with Admin access to the account opens Admin → Access and security and invites that email. Once that login accepts Google's invitation email, ask again.
   • If that login gets access through the account's manager (MCC) account instead, an owner then presses Refresh accounts on Google products, so AdCopilot learns the way in. Then ask again.
   • If the account belongs to another Google login of yours, connect that login with Connect another account on Google products. It replaces your current login: the accounts your current login found leave the list (an owner's Refresh accounts brings back any a teammate's login also reaches), and Google Analytics 4, Search Console and Google Tag Manager need connecting again.
3. If nobody in the workspace should use that account, an owner switches it Off under Your accounts.
4. Don't add a manager account ID or a login-customer-id to the call. AdCopilot refuses one and reaches the account through its manager by itself.
5. If get_org_context says the account is fine while calls to it fail, it is this case: start at step 1.

If it persists. Write to [email protected] with your workspace name, the account's name, the login your Google Ads card names, and the error text.

CUSTOMER_NOT_ENABLED

What you see. Google's error carries CUSTOMER_NOT_ENABLED. The dashboard may show Your Google Ads account isn't active.

Why it happens. Google says the Google Ads account is not enabled yet (its setup or billing is unfinished) or has been cancelled. Reconnecting does not change that.

Fix.

1. Open Google Ads with that account. Finish setting it up, including billing and anything Google asks you to verify, or reactivate it if it was cancelled.
2. Back in the dashboard, an owner presses Check again on the card that says the account isn't active, or Refresh accounts on Google products.
3. If you don't use that account, an owner switches it Off under Your accounts and switches on the account you advertise from.

If it persists. If Google Ads shows the account as active and the error continues, write to [email protected] with the account's name and the error text.

NOT_ADS_USER

What you see. Google's error carries NOT_ADS_USER, or the dashboard shows This Google account has no Google Ads account.

Why it happens. The Google login you connected has no Google Ads account. People often sign in with a work login and keep Google Ads under another.

Fix.

1. Press Connect a different Google account on that card, or use Connect another account on Google products.
2. Choose the Google login that has your Google Ads.
3. No Google Ads account under any login? Create a Google Ads account on the same card opens Google Ads; creating one is free.

If it persists. Write to support with your workspace name and the login you chose.

A manager (MCC) account is switched on

What you see. Google's error carries REQUESTED_METRICS_FOR_MANAGER, or the dashboard shows You connected a manager (MCC) account.

Why it happens. A manager account only holds other accounts. It has no campaigns or reports of its own, so AdCopilot works on a client account under it.

Fix.

1. On Google products, the owner finds the client account under Your accounts, switches it On, and switches the manager Off. AdCopilot reaches the client account through the manager by itself.
2. Client account not listed? Give the connected login access to it in Google Ads, then press Check again or Refresh accounts.

If it persists. Email [email protected] with the manager account's name.

"This connector is not authorised for account …"

What you see.

This connector is not authorised for account 1234567890.

Why it happens. AdCopilot has never found that account in this workspace. Usually the id is mistyped, it belongs to another workspace (your assistant works in the one workspace picked on AdCopilot's approval page), or it is a client account under a manager that has not been found yet.

Fix.

1. Ask your assistant to list the Google Ads accounts you can act on, or look under Your accounts on Google products, and use an id from there.
2. An owner presses Refresh accounts on Google products.
3. If the account is in another workspace, approve your assistant for that workspace: see The assistant reached the wrong workspace.

If it persists. See Account not showing up.

"AdCopilot could not read the account just now"

What you see. At the start of a conversation, get_org_context tells your assistant that AdCopilot could not read the account just now.

Why it happens. AdCopilot's first read of the account failed. The reason is in that read's error, often one of the codes on this page.

Fix.

1. The assistant says so honestly and never guesses a number.
2. It follows the fallback reading sequence get_org_context gives it.
3. If a read fails, it looks up that read's error on Troubleshooting and gives you the step.

If it persists. Write to support with the error the read returned.

Search Console: "User does not have sufficient permission for site"

What you see. A Search Console call fails with HttpError 403 and Google's message "User does not have sufficient permission for site '…'".

Why it happens. Either the site was named differently from how Search Console holds it (a domain property is sc-domain:example.com, a URL property ends in /), or the Google login connected to AdCopilot has no access to that property.

Fix.

1. The assistant calls gsc_list_sites and uses the site exactly as listed, prefix and trailing / included, then runs the call once more.
2. Not in that list? The connected login has no access to it. In Search Console, add that login as a user of the property, then ask again. AdCopilot reaches all your Google products through one Google login, so there is no separate login to pick for Search Console.

If it persists. Write to support with the site and the error text.

Analytics or Tag Manager: PERMISSION_DENIED

What you see. An Analytics or Tag Manager call fails with HttpError 403 and PERMISSION_DENIED. For Analytics attribution settings the words are AdCopilot's:

Google refused to show this property's attribution settings: the signed-in Google login cannot read that Analytics property.

Google refused the change: changing attribution settings needs the Marketer role or higher on this Analytics property, and the signed-in Google login does not have it. Nothing was changed.

Why it happens. The connected Google login cannot read that property or container, or cannot change it with the role it has there.

Fix.

1. The assistant uses the ids exactly as ga4_list_account_summaries, gtm_list_accounts and gtm_list_containers return them, then runs the call once more.
2. Missing from those lists? Add the connected login as a user in Google Analytics or Tag Manager. Changes need a role that can edit there.
3. Reading works but changes are refused with "is connected read-only"? That is the editing permission on Google's consent screen for AdCopilot, not your role in Analytics or Tag Manager: see Read-only access.

If it persists. Write to support with the property or container and the error text.